Open
Description
Problem statement
UserAssist is an artifact in Windows forensics, tracking app usage to help reconstruct user activity.
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count
I found the forensics artifact here https://github.com/MHaggis/PowerShell-Hunter/blob/e80c2bba2a5307cbd0a49047629ff9f391b8d917/UserAssist/UserAssist_Hunt.ps1#L61
Please, add the regedit path to privacy cleanup
section.
Proposed solution
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /f
Alternatives considered
No response
Additional information
No response